What is the CVSS score of CVE-2026-40789?

CVE-2026-40789 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Amelia are affected by CVE-2026-40789?

The Amelia Booking WordPress plugin (v2.2 and earlier) contains an unauthenticated vulnerability enabling remote access to sensitive customer and business data.

How to fix or mitigate CVE-2026-40789?

Within 24 hours: Identify all WordPress instances running Amelia plugin v2.2 or earlier; document business function, data sensitivity, and affected customer base for each. Within 7 days: Implement Web Application Firewall (WAF) rules to restrict plugin access; apply network-level controls limiting access to known administrative IP ranges; assess feasibility of disabling plugin if non-critical. Within 30 days: Execute primary remediation (disable, replace, or apply patch if released); deploy monitoring for exploitation attempts; conduct data access audit to confirm whether unauthorized access occurred.

Amelia CVE-2026-40789

EUVD-2026-36992 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-15 Patchstack

GHSA-cfv8-838c-fm27

Information Disclosure Amelia

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable WordPress plugin endpoint leaks sensitive data with no interaction; confidentiality-only impact, so I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:06 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows remote attackers to retrieve protected information without credentials, per a Patchstack advisory. With a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and CWE-201 classification, the flaw is network-reachable and trivially triggerable, though no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Amelia (also known as Amelia Booking, vendor TMS / cpe:2.3:a:tms:amelia) is a widely deployed WordPress appointment-booking plugin that exposes REST/AJAX endpoints to handle bookings, customer records, employees, services, and payment metadata. CWE-201 (Insertion of Sensitive Information Into Sent Data) indicates that one or more of these endpoints, or related response payloads, returns data that should be access-controlled - typically because an authorization check is missing, an internal field is leaked into a public response, or a debug/listing endpoint can be queried without a valid nonce or capability check. Because the plugin runs inside WordPress as a privileged component handling PII (names, emails, phone numbers, appointment details, and potentially payment references), any over-broad response from its endpoints translates directly into customer-data leakage.

RemediationAI

Upgrade the Amelia plugin to a version newer than 2.2 once the vendor publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-2-sensitive-data-exposure-vulnerability is the canonical reference and will list the patched version. Patch available per vendor advisory; exact fix version is not stated in the provided input, so administrators should confirm the current Amelia release on the WordPress.org plugin page before upgrading. Until patched, compensating controls include enabling Patchstack or a WAF virtual patch for this CVE, restricting access to the Amelia REST/AJAX endpoints (wp-admin/admin-ajax.php actions and /wp-json/amelia/* routes) via IP allowlisting or authenticated-only access at the web server (with the trade-off that public booking forms will break for end users), and temporarily deactivating the plugin on sites where appointment booking is not actively used.